Microsoft 365

import { DirectoryListing, GlossaryTooltip, Render } from "~/components";

<Render file="casb/integration-description" product="cloudflare-one" params={{ integrationName: "Microsoft 365 (M365)", integrationAccountType: "Microsoft 365 account", }} />

This integration covers the following Microsoft 365 products:

Integration prerequisites

Integration permissions

For the Microsoft 365 integration to function, Cloudflare CASB requires the following delegated Microsoft Graph API permissions:

• Application.Read.All
• Calendars.Read
• Domain.Read.All
• Group.Read.All
• InformationProtectionPolicy.Read.All
• MailboxSettings.Read
• offline_access
• RoleManagement.Read.All
• User.Read.All
• UserAuthenticationMethod.Read.All
• Files.Read.All
• AuditLog.Read.All
• AiEnterpriseInteraction.Read.All

These permissions follow the principle of least privilege to ensure that only the minimum required access is granted.

Additionally, to remediate findings, CASB requires the following permissions:

• Application.ReadWrite.All
• AuditLog.Read.All
• AiEnterpriseInteraction.Read.All
• Calendars.ReadWrite
• Domain.ReadWrite.All
• Files.ReadWrite.All
• Group.ReadWrite.All
• InformationProtectionPolicy.Read.All
• MailboxSettings.ReadWrite
• IdentityRiskyUser.ReadWrite.All
• RoleManagement.ReadWrite.Directory
• User.ReadWrite.All
• UserAuthenticationMethod.ReadWrite.All
• Directory.ReadWrite.All
• GroupMember.ReadWrite.All
• Organization.ReadWrite.All
• Mail.ReadWrite

To learn more about each permission, refer to the Microsoft Graph permissions documentation.

Security findings

<Render file="casb/security-findings" product="cloudflare-one" params={{ integrationName: "Microsoft 365", slugRelativePath: "microsoft-365", }} />

User account settings

File sharing

Data Loss Prevention (optional)

Microsoft 365 Copilot / AI

Third-party apps

Calendar sharing

Email administrator settings

Email forwarding

Microsoft Information Protection (MIP) sensitivity labels

:::note Requires Cloudflare Data Loss Prevention (DLP). :::

Microsoft provides MIP sensitivity labels to classify and protect sensitive data. When you add the CASB Microsoft 365 integration, Cloudflare will automatically retrieve the labels from your Microsoft account and populate them in a DLP Profile.